63789 matches found
EUVD-2026-63400
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...
CVE-2026-63039
Apache InLong versions 2.0.0 through 2.3.x are affected by a SQL Injection vulnerability caused by unvalidated MyBatis dollar-sign interpolation in the AuditAlertRuleService component. An attacker can inject arbitrary string values into SQL statements, potentially enabling unauthorized data acces...
CVE-2026-63038
Apache InLong versions 2.0.0 to before 2.4.0 are vulnerable to SQL injection via the dbName, tableName, schemaName, and username parameters, which are concatenated into SQL queries without sanitization. Attackers can inject arbitrary SQL, potentially compromising data integrity or availability. U...
CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...
EUVD-2026-63399
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...
CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
EUVD-2026-63398
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
CVE-2026-63037
Apache InLong (versions 2.0.0 through before 2.4.0 ) is affected by an unauthenticated SQL injection vulnerability in the Manager OpenAPI audit alert rule list endpoint . The injection occurs in the ORDER BY clause against the Manager backend database, allowing an attacker to craft malicious sort...
CVE-2026-63016 Apache InLong: Ordinary users can create new packages
Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
EUVD-2026-63397
Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
CVE-2026-63016
Apache InLong versions 2.0.0 through 2.3.x have an Uncontrolled Resource Consumption flaw where unauthenticated network users can upload non-official packages, potentially disrupting availability (CVSS 5.3, MEDIUM). Fix: upgrade to 2.4.0 or cherry-pick PRs #12095 and #11732. No exploitation obser...
CVE-2026-63015
CVE-2026-63015 is an Uncontrolled Resource Consumption vulnerability in Apache InLong (versions 2.0.0 through before 2.4.0). The flaw allows non-template responsible persons to view template information, which should be restricted. The CVSS 3.1 score is 4.3 (MEDIUM) with a vector of AV:N/AC:L/PR:...
EUVD-2026-63396
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
CVE-2026-63015 Apache InLong: Non-template responsible persons can view template information
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...
CVE-2026-26032
A flaw was found in Apache Ivy's PackagerResolver. An attacker with access to a packager repository can exploit this by injecting specially crafted module coordinates into ivy.xml files. These malicious coordinates, containing directory traversal sequences, allow the attacker to overwrite files...
Apache Airflow <=1.10.10 - Remote Code Execution
Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending on the executor in us...
Apache Flink - Local File Inclusion
Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. id: CVE-2020-17519 info: name: Apache Flink - Local File Inclusion author: pdtea...
